Exploiting AI & Machine Learning Systems: Adversarial Attacks against Deep Learning Algorithms

Thomas Wilhelm opens with a short introduction and frames the talk as a high-level tour of how deep learning and language model systems can be pushed into bad decisions by hostile inputs. He argues that most AI attacks reuse familiar categories from web and network testing, applied to a different platform.

He then walks through public incidents. Small stickers on a road led a Tesla's driver-assist system to behave as if a lane change was needed, and a chatbot that absorbed hostile user input began producing offensive output. Masks defeated facial recognition used to unlock accounts, and a chatbot generated its own QR code and pressed a visitor for card details. He also covers tampered medical images that could produce false diagnoses. On the data side he discusses poisoning of crowdsourced datasets, where a single altered fact in a modified model spread quickly, and an encoded query that got a product search to list items tied to a dangerous chemical. Model inversion and extraction are illustrated with a leak from a DeepSeek deployment that exposed a database and API keys.

For defenders, he reviews layered controls: differential privacy, input sanitisation, adversarial training, federated learning with cross-checking across models, blockchain-based integrity records, anomaly detection and human review. His central point is that the integrity of training data matters most, and that a mix of these controls is needed. The talk closes with a checklist for red-team exercises and open questions from the audience.